Skip to content
Threat Feed
Subscribe

Vendor

Eosphoros-Ai

4 briefs RSS
medium advisory

eosphoros-ai DB-GPT: Vulnerability in HuggingFace Adapter (CVE-2026-123019)

A weakness in the HuggingFace Adapter component of eosphoros-ai DB-GPT (up to 0.8.2) allows for the inclusion of functionality from an untrusted control sphere via the trust_remote_code argument.

DB-GPT vulnerability cve-2026-123019
1c
high advisory

eosphoros-ai DB-GPT: Code injection vulnerability (CVE-2026-123018)

A code injection vulnerability in the DB-GPT execute_code function allows for remote code execution, and public exploit code is available.

PoC DB-GPT
1c
critical advisory

Unauthenticated Remote Code Execution in DB-GPT via Path Traversal

An unauthenticated path traversal vulnerability in DB-GPT allows remote attackers to write arbitrary files and achieve remote code execution by uploading malicious Python modules to the application server.

DB-GPT vulnerability rce path-traversal webserver
1r 2t 1c
critical advisory

Unauthenticated Path Traversal in DB-GPT

DB-GPT version 0.8.1 is vulnerable to an unauthenticated path traversal attack allowing remote code execution via a crafted user_id HTTP header.

PoC DB-GPT web-application-vulnerability path-traversal rce
1r 1t 1c updated